Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
21/10/2023, 21:31
Behavioral task
behavioral1
Sample
NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
-
Size
33KB
-
MD5
c5c95a5b5ef9647cc82bda0fe0b4f250
-
SHA1
a664e3487a609967618686d8adc4bcf90416f21c
-
SHA256
bf938d651366648b6f568f1d86c5a1301bd1ed9e2b9c827a4ae2998956bb03a5
-
SHA512
075b1a4fdd237cc37c0e22ce3fb2446e526ba6756cb4001aefa1320807b7ca97f31c7a51091d84c8be83ddfb3ff673bacbc75d1ac7937fa34851e708895d86d2
-
SSDEEP
768:r5Gsq/XQGcoGVzUDWbcvZOkglUWJY3ggxfha54h:r5GD/XPgQGcvZORS3g+
Malware Config
Signatures
-
resource yara_rule behavioral1/files/0x00010000000108af-9.dat aspack_v212_v242 -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\b: NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe File opened for modification \??\c:\Program Files\7-Zip\Uninstall.exe NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe File opened for modification \??\c:\Program Files\Internet Explorer\ielowutil.exe NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\chrome.exe NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe File opened for modification \??\c:\Program Files\Internet Explorer\ieinstal.exe NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\java-rmi.exe NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\jps.exe NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\apt.exe NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\java.exe NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe File opened for modification \??\c:\Program Files\DVD Maker\DVDMaker.exe NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe File opened for modification \??\c:\Program Files\7-Zip\7zG.exe NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\jabswitch.exe NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe File opened for modification \??\c:\Program Files\Internet Explorer\iexplore.exe NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\javap.exe NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\jar.exe NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\javac.exe NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe File opened for modification \??\c:\Program Files\7-Zip\7zFM.exe NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1640 NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe 1640 NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe 1640 NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe 1640 NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe 1640 NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe 1640 NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe 1640 NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe 1640 NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe 1640 NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe 1640 NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe 1640 NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe 1640 NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe 1640 NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe 1640 NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe 1640 NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe 1640 NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe 1640 NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe 1640 NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe 1640 NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe 1640 NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe 1640 NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe 1640 NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe 1640 NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe 1640 NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe 1640 NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe 1640 NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe 1640 NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe 1640 NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe 1640 NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe 1640 NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe 1640 NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe 1640 NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe 1640 NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe 1640 NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe 1640 NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe 1640 NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe 1640 NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe 1640 NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe 1640 NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe 1640 NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe 1640 NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe 1640 NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe 1640 NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe 1640 NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe 1640 NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe 1640 NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe 1640 NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe 1640 NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe 1640 NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe 1640 NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe 1640 NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe 1640 NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe 1640 NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe 1640 NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe 1640 NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe 1640 NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe 1640 NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe 1640 NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe 1640 NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe 1640 NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe 1640 NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe 1640 NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe 1640 NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe 1640 NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1640 wrote to memory of 1736 1640 NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe 28 PID 1640 wrote to memory of 1736 1640 NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe 28 PID 1640 wrote to memory of 1736 1640 NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe 28 PID 1640 wrote to memory of 1736 1640 NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe 28 PID 1640 wrote to memory of 2244 1640 NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe 30 PID 1640 wrote to memory of 2244 1640 NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe 30 PID 1640 wrote to memory of 2244 1640 NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe 30 PID 1640 wrote to memory of 2244 1640 NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Windows\SysWOW64\at.exeat 1 /delete /yes2⤵PID:1736
-
-
C:\Windows\SysWOW64\at.exeat 4:01:24 AM "C:\Users\Admin\AppData\Local\Temp\NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe"2⤵PID:2244
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
151KB
MD5e7dc3153b95fc3afeb74ff63943236f5
SHA1856bd30f5b2185ec9958feed4fc8ef694c6050ab
SHA256e281d0046b927bebc46ef07f7bd35fb46f5bc17b2f8c00f44bdcfc8677e12c94
SHA5120265d0a4ee5f541252f0afe08f3e4c5e1eb95a1bffdfe2379032d5ed782eb5d944c830fcc283ec20acac91efa798bf51649d21b449b5899965114c959c1a570f